yara-scan-batch
Reads a file store URL from each input row, scans that file with enabled YARA rules, and adds the detection result to the row.
yara-scan-batch [field=VALUE] [timeout=VALUE] [max-size=VALUE]
- field=VALUE
- Optional. Input field containing a file store URL. Default: file_url. Each URL must identify a file, not a directory.
- timeout=VALUE
- Optional. Per-file scan timeout in seconds. Default: 60.
- max-size=VALUE
- Optional. Maximum file size in bytes. Default: 67108864 (64 MiB). Larger files produce an error result.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _matched_count | Integer | Match count | e.g. 2 |
| _matched_rules | String | Matched rules | e.g. EICAR_Test_File |
| _error | String | Error | e.g. file too large (over 67108864 bytes) |